fix(auth-backend): harden default allowed patterns for CIMD and DCR (#34260)

* fix(auth-backend): harden default allowed patterns for CIMD and DCR

Signed-off-by: benjdlambert <ben@blam.sh>

* address PR review feedback for OIDC defaults

- narrow CLI client ID pattern to exact cli.json path
- add BREAKING prefix to changeset
- add IPv6 [::1] to docs examples
- add loopback redirect URI tests for IPv6 and 127.0.0.1

Signed-off-by: benjdlambert <ben@blam.sh>

* remove dead ['*'] fallback when features are disabled

The restrictive defaults are now always used regardless of the enabled
flag, since the patterns are only consulted on code paths that require
the feature to be enabled.

Signed-off-by: benjdlambert <ben@blam.sh>

* add default pattern tests and fix docs cli example

Signed-off-by: benjdlambert <ben@blam.sh>

* use URL constructor for CLI client ID

Signed-off-by: benjdlambert <ben@blam.sh>

* use string templating for cliClientId to match OidcRouter

Signed-off-by: benjdlambert <ben@blam.sh>

* fix docs: remove misleading CLI client_id URL example

Signed-off-by: benjdlambert <ben@blam.sh>

---------

Signed-off-by: benjdlambert <ben@blam.sh>

docs/ai/mcp-actions.md

@@ -200,14 +200,21 @@ This can be enabled in the `auth-backend` plugin by using the `auth.experimental
 auth:
   experimentalClientIdMetadataDocuments:
     enabled: true
-    # Optional: restrict which `client_id` URLs are allowed (defaults to ['*'])
-    allowedClientIdPatterns:
-      - 'https://example.com/*'
-      - 'https://*.trusted-domain.com/*'
-    # Optional: restrict which redirect URIs are allowed (defaults to ['*'])
-    allowedRedirectUriPatterns:
-      - 'http://localhost:*'
-      - 'https://*.example.com/*'
+    # Optional: override which client_id URLs are allowed.
+    # Defaults to Claude, VS Code, and the built-in Backstage CLI.
+    # Note: setting this replaces the defaults entirely. The built-in
+    # CLI pattern is derived from your auth backend's base URL and
+    # must be re-added manually if you override this list.
+    # allowedClientIdPatterns:
+    #   - 'https://claude.ai/*'
+    #   - 'https://vscode.dev/*'
+    #   - 'https://my-custom-client.example.com/*'
+    # Optional: override which redirect URIs are allowed.
+    # Defaults to loopback addresses (localhost, 127.0.0.1, [::1]).
+    # allowedRedirectUriPatterns:
+    #   - 'http://localhost:*'
+    #   - 'http://127.0.0.1:*'
+    #   - 'http://[::1]:*'
 ```
 
 #### Dynamic Client Registration
@@ -224,10 +231,13 @@ This can be enabled in the `auth-backend` plugin by using the `auth.experimental
 auth:
   experimentalDynamicClientRegistration:
     enabled: true
-
-    # Optional: limit valid callback URLs for added security
-    allowedRedirectUriPatterns:
-      - cursor://*
+    # Optional: restrict which redirect URIs are allowed.
+    # Defaults to Cursor and loopback addresses (localhost, 127.0.0.1, [::1]).
+    # allowedRedirectUriPatterns:
+    #   - 'cursor://*'
+    #   - 'http://localhost:*'
+    #   - 'http://127.0.0.1:*'
+    #   - 'http://[::1]:*'
 ```
 
 ## Configuring MCP Clients